import java.util.*;
import java.util.logging.*;

/**
 * transformers-0002: convert_regnet_seer_10b_to_pytorch.py logs HF_TOKEN verbatim
 *
 * Models CWE-312 (MOAD-0004): credential logged in cleartext.
 * Verifies that the defective pattern emits the secret and the patched pattern
 * emits a safe redacted message instead.
 *
 * Mirrors src/transformers/models/regnet/convert_regnet_seer_10b_to_pytorch.py line 236.
 */
public class Transformers0002RegnetHfTokenLoggedTest {

    static final String FAKE_TOKEN = "hf_FAKESECRETTOKEN_1234567890abcdef";

    static List<String> logMessages = new ArrayList<>();

    static class CapturingLogger {
        void info(String msg) {
            logMessages.add(msg);
        }
    }

    // --- Defective implementation ---
    static void pushToHubDefective(CapturingLogger logger, String hfToken) {
        // Mirrors: logger.info(f"Token is {os.environ['HF_TOKEN']}")
        logger.info("Token is " + hfToken);
        logger.info("Loading our model.");
    }

    // --- Patched implementation ---
    static void pushToHubPatched(CapturingLogger logger, String hfToken) {
        // Token value is not logged - only presence/intent noted
        logger.info("Pushing model to the Hub (token loaded from HF_TOKEN env var).");
        logger.info("Loading our model.");
    }

    public static void main(String[] args) {
        CapturingLogger logger = new CapturingLogger();

        // --- Test defective: secret appears in log ---
        logMessages.clear();
        pushToHubDefective(logger, FAKE_TOKEN);
        boolean secretLeaked = logMessages.stream().anyMatch(m -> m.contains(FAKE_TOKEN));
        assert secretLeaked : "FAIL: defective code should log the token verbatim";

        // --- Test patched: secret does NOT appear in log ---
        logMessages.clear();
        pushToHubPatched(logger, FAKE_TOKEN);
        boolean secretInPatchedLog = logMessages.stream().anyMatch(m -> m.contains(FAKE_TOKEN));
        assert !secretInPatchedLog
            : "FAIL: patched code must not log the token, but found it in: " + logMessages;

        // Patched log should still confirm the push is happening
        boolean hasSafeMessage = logMessages.stream().anyMatch(m -> m.contains("HF_TOKEN"));
        assert hasSafeMessage : "FAIL: patched log should mention env var name (not value)";

        System.out.println("transformers-0002 MOAD-0004 HF_TOKEN credential logging");
        System.out.println("  Defective: token logged verbatim → secret exposed in log");
        System.out.println("  Patched:   token value omitted → safe redacted message");
        System.out.println("  CWE-312: Cleartext Storage of Sensitive Information");
        System.out.println("PASS");
    }
}